Privacy Notice

1. Who is responsible for your data

Each school that uses Schoolly decides what student, parent and staff information it records and why. That school is the “data controller” for it, and Schoolly acts as its “data processor”: we store and process the information on the school’s behalf and only on its instructions. Schoolly is itself the controller for the account details of school administrators who register, for billing and platform-security records, and for the operation of this website. If you are a parent or student, requests about school records are best made to your school first.

2. What we collect

• Student information: name, admission number, class, date of birth, gender, attendance, assessment and exam scores, report cards, and any photo or documents the school chooses to upload.
• Parent and guardian information: name, phone number, email address and the students they are linked to.
• Staff information: name, email, role, staff code, department, salary structure and payslips, clock-in and clock-out records, and, where the school turns on attendance geofencing, the device location at the moment of clock-in.
• Fees and payments: fee schedules, amounts paid, payment references and status. Card and bank details are entered on the payment provider’s own page and are not stored by Schoolly.
• Account and security data: email, a securely hashed password, sign-in times, device and browser description for the sessions list, and an audit trail of important actions such as score changes and payments.
• Messages: announcements, notifications and the delivery status of SMS and email sent through the platform.

3. Why we use it

We use personal data to provide the service the school has asked for: running registers and scores, producing report cards, recording fees, sending notices, paying staff records, keeping accounts secure and preventing misuse. We do not sell personal data, and we do not use it for advertising or to profile children.

Where the law requires a legal basis, we rely on performance of the agreement with the school, the school’s and Schoolly’s legitimate interest in running and securing the service, compliance with legal obligations, and consent where we ask for it (for example, accepting these terms when a school registers).

4. Children’s data

Student records belong to the school and are entered by authorised staff. Schools are responsible for having the proper basis, such as parental or guardian consent, to record and use information about the children they teach. We limit student information to what is needed for schooling and make it visible only to people whose role requires it.

5. Who can see it

Inside a school, access depends on role: for example, a teacher sees their own classes, a parent sees only their own children, and fee staff see fee records. Each school’s data is kept separate from every other school’s. A small number of Schoolly personnel can access data only where needed to operate, secure or support the platform.

6. Service providers we use

We share only the data each provider needs to do its job, under confidentiality and data-protection obligations:

• cloud hosting, database and file storage providers, to run the platform;
• SMS and email delivery providers, to deliver notices a school sends (they receive the recipient’s phone number or email address and the message text);
• the payment provider the school has chosen (for example Remita), to process online fee payments;
• an AI provider, only if the school switches on the AI assistant. The assistant is designed to receive curriculum content such as subject, class, topic, objectives and textbook excerpts. It is not designed to receive student records, so staff should not type students’ personal details into its prompts.

Some providers operate outside Nigeria. Where personal data is transferred abroad, we require appropriate safeguards as the Nigeria Data Protection Act 2023 and similar laws require. We may also disclose data when the law or a court requires it.

7. How we protect it

• All traffic between your browser and Schoolly is encrypted with HTTPS.
• Passwords are stored only as salted hashes and are never shown or logged.
• Access is limited by role, and each school’s records are separated from other schools’.
• Important actions are recorded in an audit trail, and sign-in attempts are rate limited.

No system is perfectly secure. If a breach affects personal data, we will notify the affected school and the authorities within the time the law requires so that people can be told.

8. How long we keep it

A school’s records are kept while its account is active, so that results, report cards and fee history remain available. When a school deletes its account or asks us to, we erase its data from the live system; copies in backups are removed as those backups expire. Security and billing records may be kept for as long as the law or legitimate security needs require.

9. Your rights

Under the Nigeria Data Protection Act 2023 and, where it applies, the GDPR, you can ask to see the personal data held about you, have it corrected, have it erased or restricted, object to certain uses, receive a copy in a portable form, and withdraw consent you gave earlier. Ask your school first for student, parent or staff records; for anything Schoolly controls, contact us using the details below. We will respond within the period the law allows. If you are not satisfied you may complain to the Nigeria Data Protection Commission or your local data-protection authority.

10. Cookies and local storage

Schoolly uses your browser’s storage only to keep you signed in and remember simple preferences. We do not use advertising or third-party tracking cookies.

11. Changes

We will update this notice when our practices change and show the date at the top. For significant changes we will tell school administrators in advance.